Can JWT authentication support multiple API?

Viewed 850

Can JWT authentication support multiple APIs.So the users will have the same username/password for the multiple APIs and can login to multiple APIs simultaneously using the same token.

I did a lot of research but still could not find anything relevant.

1 Answers

Definitely yes.

One of the main strengths of JWT tokens is that they do not require a central authentication authority, as long as each token can be verified (i.e. the API holds the required keys to verify the signature). So each API can verify the authenticity of the token, which in turn holds the authorization data, without any modification (other than verifying the JWT token).

In a multi-API (multi principal) setup, there would be a token issuance service (which handles authentication requests by verifying credentials and issuing tokens). Then, each principal can accept/verify these tokens without knowing anything about the credentials.

Further more, you can use aud (Audience) field to discriminate API usage. An API , after verifying the JWT, can examine the aud field and only accept the token if it can identify itself in the aud data. Check this wikipedia article for more info

Related